Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonToObjectTransformer. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted jsonTypeId message header that is mapped from an external source, such as...